Use when writing any SQL for Supabase — creating views, tables, functions, or RLS policies. Supabase has several security behaviors that differ from vanilla Postgres in ways that silently create vulnerabilities. This skill makes sure those traps are caught before they ship. Trigger whenever the user is working with…
Browser-based cybersecurity education platform with guided lessons, quizzes, gamified progression, and adaptive learning scenarios for information security practice.
Use before installing, trusting, or running any third-party OpenClaw skill, and when the user says "scan this skill", "is this skill safe", "vet/check this skill", "should I install this", "audit my skills", or "clawvet". Also use when reviewing a SKILL.md pulled from ClawHub or an untrusted source.
A batch verification process that checks proof-of-concept items against a list of assets. It runs the checks in parallel and produces a results matrix and Markdown report.
An AI-assisted workflow for diagnosing and fixing coding errors, agent problems, and security issues. CyberHuaTuo is the name of the included AI clinic concept.
Audit the shell startup chain (the rc file + every file it sources) for hardcoded credentials, persistence-suspicious patterns, duplicate or dangling aliases, and git-baseline drift. USE WHEN the user wants to review, secure, clean up, or maintain their shell aliases or startup files; check /.zshrc / /.bashrc for…
This rule automatically analyzes dependencies before they're installed to provide insights about maintenance frequency, security vulnerabilities, and popularity in the developer ecosystem.
Da7rkx0 represents dark web reconnaissance capabilities used during authorized threat intelligence gathering and security assessments. Understanding dark web monitoring is essential for proactive defense — identifying leaked credentials, sold data, and emerging threats before they are exploited.
OneCLI Gateway: transparent HTTPS proxy that injects stored credentials into outbound calls. You MUST use this skill when the user asks you to read emails, check calendar, access GitHub repos, create issues, check Stripe payments, or interact with ANY external service or API. Do NOT use browser extensions or OAuth CLI…
Install, find, link, update and validate engineering standards from the Agent.md registry (304 free MIT markdown standards across 20 categories) using the activate-agentmd CLI; print the breaking changes for the dependency majors this project runs; and lint agent instruction files for leaked keys and prompt injection.…
Read a dxkit report and execute fixes — prioritize findings by severity, plan the fix sequence, run the fix, verify the score moved, re-baseline if appropriate. Supports a SCOPED pass to burn down one category at a time (dependency/BOM vulnerabilities, security, code quality, tests, docs), and a BASELINE-CLEANUP pass…
Use when an agent or role needs credentials on a machine that does not have them — a fresh container, a rebuilt host, a successor session — or when sealing, rotating, or verifying secrets kept in a shared object store.
Use this skill whenever a user asks about wallet safety, fraud risk, rug pull detection, wallet behavior analysis, DeFi personalization, on-chain reputation scoring, AML checks, token ranking by holder quality, airdrop screening, lending risk, token launch auditing, or AI agent trust scoring. Triggers on questions…
Drafts NIS2 incident reports for a small WordPress agency or freelancer, especially one acting as supply chain to a regulated client rather than as a regulated entity itself. Use this skill whenever someone needs to draft or produce a NIS2 incident notification: a 24-hour early warning, a 72-hour notification, a…
A general-purpose guide for examining JavaScript code to identify website encryption, request signatures, and anti-bot checks, then documenting the findings in Python.
Coordinate the local Xray/VLESS/XHTTP VPN workflow, route tasks to internal worker modules, enforce scoped alarms, and accept outputs only after evidence and review.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: